Failure-Guided Fuzzing for Hybrid Quantum–Classical Programs Lei Zhang
arXiv:2605.14219v1 [cs.SE] 14 May 2026
Department of Information Systems University of Maryland, Baltimore County Maryland, USA [email protected]
Abstract—Hybrid quantum-classical (HQC) algorithms, such as the Variational Quantum Eigensolver (VQE) and the Quantum Approximate Optimization Algorithm (QAOA), are central to near-term quantum computing but remain challenging to test. Sampling-based fuzzing can expose faulty or non-convergent configurations, but under realistic execution budgets, it may miss failure-prone regions in the joint space of classical optimizer settings and quantum circuit parameters. This paper studies failure-guided fuzzing for HQC programs. It models a hybrid input as a pair of classical optimizer hyperparameters and quantum circuit parameters, and evaluates a two-phase strategy that first searches for non-convergent seeds and then locally fuzzes circuit parameters around those seeds. To understand where the gains come from, five budgeted strategies are compared: random hybrid testing, classical enumeration without fuzzing, random-seed local fuzzing, enumeration-seed local fuzzing, and concolic-seed local fuzzing. The study is implemented on a VQE instance and a QAOA MaxCut instance in Qiskit. The results show that failure-guided local fuzzing is the main driver of improvement over random testing, while concolic seed discovery provides additional benefits on VQE but is less stable on QAOA. These findings suggest that reusing failure information is a promising direction for HQC testing, but that the value of concolic seed discovery is workload-dependent. Index Terms—quantum software engineering, hybrid quantum-classical programs, failure-guided fuzzing, concolic execution
I. I NTRODUCTION Hybrid quantum-classical (HQC) algorithms, such as the Variational Quantum Eigensolver (VQE) [1] and the Quantum Approximate Optimization Algorithm (QAOA) [2], are a central pillar of the current Noisy Intermediate-Scale Quantum (NISQ) era [3]. In these workloads, a classical optimizer iteratively updates circuit parameters, invokes a parameterized quantum circuit on a backend or simulator, and uses measurement outcomes to drive subsequent updates. This tight feedback loop between classical control logic and quantum execution makes HQC programs difficult to test: failures may arise from the quantum circuit, the optimizer, their interaction, or the stochastic nature of measurements [4], [5]. Recent work in quantum software engineering has begun to adapt techniques such as unit testing [6], [7], mutation testing [8], [9], and fuzzing [10] to the quantum setting. In particular, sampling-based fuzzing has been proposed as a way to explore large quantum input spaces by generating many random inputs and searching for crash-inducing executions [10].
While such techniques can be effective on small examples, they face a fundamental rare-event barrier: under realistic testing budgets, random sampling may fail to hit combinations of classical hyperparameters and quantum circuit parameters that trigger non-convergence or other faulty behavior. Moreover, many existing quantum testing approaches either treat the classical and quantum components largely in isolation, or reason about quantum behavior at the level of circuits and states without explicitly leveraging the structure of the classical control flow and optimizer hyperparameters [11]. This leaves a gap: testing methods are needed that can systematically explore the classical control side of HQC programs and then focus fuzzing effort on regions of the circuit-parameter space that appear failure-prone. This paper studies failure-guided fuzzing for HQC programs. A hybrid input is modeled as a pair of hybrid inputs h = (c, θ), where c denotes classical hyperparameters (e.g., optimizer type, iteration limit, and learning rate) and θ denotes quantum circuit parameters (e.g., rotation angles in a VQE or QAOA ansatz). A run is classified as a crash if the hybrid execution fails to converge to a workload-specific target value within a fixed resource budget; this serves as a nonconvergence oracle. The prototype evaluates a two-phase failure-guided strategy. First, a seed-discovery phase searches for non-convergent hybrid inputs using random sampling, classical enumeration, or lightweight concolic exploration over discrete classical hyperparameters. In the structured two-phase variants, ENUMFUZZ uses enumerative seed discovery followed by local fuzzing, while SYM-FUZZ uses an SMT-backed (Satisfiability Modulo Theories [12]) symbolic explorer to obtain pathdiverse classical inputs [13]. Second, the local fuzzing phase mutates circuit parameters around crash-inducing seeds while keeping the classical configuration fixed [14]. The study is instantiated on two small but representative HQC workloads: a 2-qubit VQE instance with a simple variational Hamiltonian and a 4-qubit QAOA MaxCut instance on a ring graph, both implemented in Qiskit [15].1 To disentangle the sources of testing effectiveness, five strategies 1 The prototype targets small VQE and QAOA instances on noiseless simulators. The goal is not to claim scalability to large real-world workloads, but to assess how different budgeted testing strategies behave on representative HQC patterns.
Expected crashes B · 2−Nq
B = 103
103
4
B = 10
B = 105 E[X] = 1 100
Suppose a fuzzing campaign executes the program B times independently. Let XNq be the random variable counting how many crashes are observed in those B runs. Under the standard Bernoulli model, the expected number of crashes is: E[XNq ] = B pNq ≤ B · 2−Nq −−−−−→ 0. Nq →∞
10−3
5
10
15
20
Number of qubits Nq
Fig. 1: Illustration of the rare-event barrier. If a crash occurs only when a specific Nq -qubit bitstring is observed and the measurement distribution is close to uniform, then the expected number of crashes under budget B is at most B · 2−Nq . Even large fixed budgets quickly fall below the expected crash as Nq grows. are compared under the same execution budget. The first two are non-fuzzing baselines: random hybrid testing (RH), which samples both c and θ from fixed global distributions, and ENUM, which performs classical enumeration without local fuzzing. The remaining three are failure-guided local-fuzzing strategies: RAND-FUZZ, which fuzzes around the worst crash seeds found by random testing; ENUM-FUZZ, which fuzzes around crash seeds found by classical enumeration; and SYMFUZZ, which fuzzes around crash seeds found by concolic seed discovery. Together, these strategies separate the effects of unguided random exploration, classical exploration, local fuzzing, and concolic seed discovery. This work makes 3 contributions. First, it formulates failure-guided fuzzing for HQC programs by treating (c, θ) as the testing object and using non-convergence as a budgetaware oracle; it then introduces a two-phase prototype that combines crash-seed discovery with local circuit-parameter fuzzing. Second, it empirically disentangles the roles of random exploration, classical enumeration, local fuzzing, and concolic seed discovery through a five-strategy evaluation on two case studies, i.e., VQE and QAOA. Last but not least, the artifacts, including source code and experimental results, are publicly available on Zenodo at doi:10.5281/zenodo.19718515. II. M OTIVATION : R ARE -E VENT C HALLENGES Sampling-based fuzzing has been proposed as a way to explore large quantum input spaces by generating many random inputs and observing the resulting measurement distributions [10]. However, purely random exploration can face a rare-event problem. Consider a toy hybrid program that crashes only when the measured state equals a single Nq -qubit bitstring z ⋆ . Let pNq denote the crash probability of one run: pNq = Pr measurement outcome = z ⋆ . If the measurement distribution is close to uniform, then pNq ≤ 2−Nq .
Thus, for any fixed budget B, the expected number of observed crashes decreases exponentially in Nq . This toy example does not model all HQC failures, but it illustrates why unguided sampling may waste substantial budget before reaching failureprone regions. Figure 1 illustrates this scaling behavior for several fixed testing budgets. Even when the budget increases from 103 to 105 executions, the expected number of observed crashes drops rapidly as the number of qubits Nq grows. This motivates testing strategies that reuse information from observed failures. In this paper, failure-guided local fuzzing reallocates budget around crash-inducing seeds instead of repeatedly sampling fresh hybrid inputs from a global distribution. Concolic guidance is then studied as one way to improve seed discovery by using structural information from the classical optimizer configuration space. III. FAILURE -G UIDED F UZZING A PPROACH This section describes the failure-guided fuzzing prototype. The key idea is to identify crash-inducing hybrid inputs early and reuse them by locally fuzzing nearby circuit parameters. The study evaluates multiple seed-discovery mechanisms—random sampling, classical enumeration, and concolic guidance—to separate the effects of random exploration, structured classical exploration, local fuzzing, and concolic seed discovery. Figure 2 summarizes the workflow. A. Hybrid Inputs and Failure Oracle An HQC program is modeled as a hybrid driver H YBRID P ROG(c, θ) → trace, where c denotes classical hyperparameters and θ denotes quantum circuit parameters, typically rotation angles in a parameterized ansatz. In the prototype, the classical configuration is c = (opt, max iter, lr) ∈ C, where opt is the optimizer type, max iter is the iteration limit, and lr is the learning rate. The circuit parameter vector satisfies θ ∈ Θ ⊆ Rd , with angles identified modulo 2π. Executing H YBRID P ROG on a hybrid input h produces a trace containing classical optimizer states, quantum objective estimates obtained from sampled measurements or statevector simulation, and estimates of a scalar objective J(h), such as the energy in VQE or the MaxCut objective in QAOA. Following common practice in variational algorithm debugging [16], the prototype uses non-convergence as the test oracle. Given a reference target value J ⋆ and tolerance τ > 0, a run is classified as non-crashing if the best observed cost satisfies J(h) ≤ J ⋆ + τ and as crashing otherwise. Thus, a crash
Classical hyperparameter space
Seed discovery (random / enum / concolic)
Crash seeds (ĉi , θ̂ i )
Local circuit-parameter fuzzing around θ̂ i
Hybrid driver (VQE / QAOA)
Crash statistics under budget B
Fig. 2: Failure-guided fuzzing workflow: crash seeds are discovered through random, enumerative, or concolic exploration, then used for local circuit-parameter fuzzing under a fixed budget.
indicates that the optimizer terminated without reaching the target objective within the allotted resource budget. B. Overview of the Failure-Guided Strategy The prototype separates testing into two responsibilities: discovering crash-inducing hybrid inputs and exploiting them through local fuzzing. Seed discovery can be instantiated by random sampling, classical enumeration, or concolic exploration over discrete classical hyperparameters. Given crash seeds (ĉ, θ̂), the fuzzing phase fixes ĉ and locally perturbs θ̂ to search nearby failure-prone regions. This design enables the experiments to isolate the effects of classical exploration, local fuzzing, and concolic seed discovery. C. Seed Discovery over Classical Hyperparameters The seed-discovery phase explores the discrete classical hyperparameter space C. It does not symbolically encode quantum states or real-valued circuit parameters; each explored configuration is paired with an initial θ drawn from the same fixed distribution across strategies. RAND-FUZZ uses the same random hybrid sampling procedure as RH during seed discovery, then selects crashinducing inputs for local fuzzing. This strategy isolates the effect of local fuzzing when seeds are obtained without structured classical exploration. ENUM-FUZZ uses enumeration to explore all configurations in C and runs H YBRID P ROG once for each pair (c, θ). Used without the fuzzing phase, the same enumerative exploration gives the ENUM baseline, which measures the value of structured classical exploration alone. When crashinducing inputs found by enumeration are used as seeds for local fuzzing, the resulting two-phase strategy is ENUMFUZZ. SYM-FUZZ uses a lightweight SMT-backed concolic engine during seed discovery. The engine introduces integer indices representing optimizer type, iteration limit, and learning rate. During execution, branch predicates over these discrete variables are recorded and selectively flipped to obtain pathdiverse classical configurations [12], [13]. The search maintains a worklist of path states and stops when the worklist is empty or a small bound mmax is reached. Each explored configuration is executed with an initial θ, producing a result r = (c, θ, crash(h), J(h)). D. Crash Seed Selection Given seed-discovery results Rseed , the prototype filters to crashing runs with defined costs and ranks them by severity. Severity is measured by how far the best observed objective remains from the target after normalizing the objective to a minimization form. The prototype then greedily selects up to
k seeds, prioritizing the most severe crashes while avoiding duplicate classical configurations c = (opt, max iter , lr ). This diversity constraint prevents the fuzzing phase from spending the remaining budget on multiple seeds with the same classical setting. E. Local Fuzzing of Circuit Parameters Given a crash seed (ĉ, θ̂), the fuzzing phase explores nearby circuit-parameter configurations that may also induce nonconvergence. The classical configuration ĉ is kept fixed, and each new parameter vector is sampled as θ ′ = θ̂ + η
(mod 2π),
η ∼ N (0, σ 2 I).
The scale σ controls locality: smaller values stay close to the seed, while larger values explore more diverse but less tightly localized inputs. Given a fuzzing budget Bfuzz , the prototype distributes the budget evenly across the selected seeds, allocating approximately Bfuzz /k runs per seed. Each fuzz run executes H YBRID P ROG on (ĉ, θ ′ ) using the same backend and measurement settings as in seed discovery, then applies the nonconvergence oracle. The resulting crash and non-crash outcomes are aggregated to compute the crash counts and rates for the fuzzing phase. This design assumes that non-convergent executions often occur in local neighborhoods of the variational parameter space. This assumption is plausible for variational algorithms with relatively smooth cost landscapes, but may be weaker for more rugged workloads such as QAOA. IV. E XPERIMENTAL D ESIGN This section describes the experimental methodology for evaluating failure-guided fuzzing on the VQE and QAOA case studies. The evaluation is driven by three research questions: RQ1. Under a fixed budget, do local-fuzzing strategies discover more non-convergence failures than RH and ENUM? RQ2. Does concolic seed discovery in SYM-FUZZ improve over random-seed local fuzzing, and is the effect workloaddependent? RQ3. How stable are the strategies across repeated trials and across the two workloads? To answer these questions, the experiments compare five strategies under identical execution budgets: RH, ENUM, ENUM-FUZZ, RAND-FUZZ, and SYM-FUZZ. A. Experimental Setup All experiments are implemented in Python using Qiskit and the Aer simulator as the quantum backend [17]. A budgeted execution model is used to ensure a fair comparison. For each workload (VQE or QAOA) and each strategy, the experiment
TABLE I: Workload and testing parameters used in the main experiments. Item
VQE
QAOA
Qubits Circuit Classical params Iterations Budget B Trials T Oracle Tolerance σ Shots
2 2-layer Ry ansatz opt, max iter, lr {5, 10, 20} 2,000 20 non-convergence 0.3 0.2 N/A (statevector)
4 depth-P ring MaxCut (P = 2) opt, max iter, lr {5, 10, 20} 2,000 20 non-convergence 0.5 0.2 1024
runs T = 20 independent trials, each under the same budget B = 2,000 program runs but with different random seeds. A program run denotes one call to the hybrid driver with a specific hybrid input h, including all quantum circuit executions required by the optimizer. Each trial records the total number of crashes C and the crash rate C/B. Results are reported as the mean and standard deviation of crash counts C and crash rates C/B over the T trials. The five strategies are: 1) RH: random hybrid testing, where each run samples a fresh classical configuration c and circuit-parameter vector θ from fixed global distributions. 2) ENUM: classical enumeration without local fuzzing, which isolates the effect of structured exploration of C alone. 3) ENUM-FUZZ: local fuzzing around crash seeds found by classical enumeration. 4) RAND-FUZZ: local fuzzing around the worst crash seeds found by random hybrid testing. 5) SYM-FUZZ: local fuzzing around crash seeds found by a lightweight concolic/symbolic explorer. For the local-fuzzing strategies (RAND-FUZZ, ENUMFUZZ, and SYM-FUZZ), the seed-selection rule, fuzzing scale, and fuzzing budget are kept fixed for a given workload. Thus, differences among these strategies reflect how crash seeds are discovered rather than changes in the local fuzzing procedure.
q0
RY
RY
q1
RY
RY
0 1
2 3
Fig. 3: Parametrized 2-qubit VQE ansatz used in the case study: two layers of Ry rotations separated by a CNOT entangling gate. TABLE II: VQE: crash statistics over T = 20 trials with budget B = 2,000 hybrid runs per trial. Values are reported as mean ± standard deviation. Strategy
Crashes per trial
Crash rate
RH ENUM ENUM-FUZZ RAND-FUZZ SYM-FUZZ
200.9 ± 17.8 494.6 ± 9.6 1387.3 ± 223.7 1430.5 ± 86.9 1513.8 ± 66.3
0.100 ± 0.009 0.247 ± 0.005 0.694 ± 0.112 0.715 ± 0.043 0.757 ± 0.033
The non-convergence tolerance and local fuzzing scale σ are fixed in the main experiments. These settings are chosen so that RH observes a non-trivial but not overwhelming crash rate, allowing the experiments to compare how effectively each strategy uses the same budget. Section V also reports a sensitivity analysis over the tolerance and σ values. V. E XPERIMENTAL R ESULTS This section reports the results of the five-strategy evaluation on the VQE and QAOA workloads. The analysis focuses on two budget-aware metrics: crash count and crash rate. Crash count measures how many non-convergent executions are observed within the fixed budget, while crash rate normalizes this count by the total number of hybrid driver calls. These metrics indicate how effectively each strategy reaches failure-prone regions of the hybrid input space. They do not necessarily represent distinct root-cause faults, since nearby crashes may reflect multiple manifestations of the same underlying issue. A. VQE Case Study
B. Workload-Specific Configuration Table I summarizes the workload and testing parameters used in the main experiments. The budgeted design and strategy definitions are kept identical for VQE and QAOA; only the hybrid driver and workload-specific oracle differ. Both workloads use the same structure of classical hyperparameters: optimizer type, maximum iteration count, and learning rate. For VQE, the objective is normalized so that lower values indicate better energy estimates, and non-convergence is defined as failing to reach J ⋆ + τ within the iteration budget. For QAOA, the MaxCut objective is converted to the same minimization form by using the gap between the maximum cut value and the observed cut value. For the 4-node ring graph, the maximum cut value is 4.
The VQE case study follows the standard variational structure: a parameterized ansatz U (θ) prepares a quantum state |ψ(θ)⟩, measurements estimate the objective associated with a problem Hamiltonian, and a classical optimizer updates the circuit parameters. The prototype uses a 2-qubit hardwareefficient ansatz with two layers of Ry rotations separated by a CNOT gate, as shown in Fig. 3. Crash counts and crash rates. Table II and Fig. 4 show that all structured or failure-guided strategies outperform RH on VQE. RH finds 200.9±17.8 crashes per trial, corresponding to a crash rate of 0.100 ± 0.009. ENUM improves this to 494.6 ± 9.6 crashes per trial, indicating that structured exploration of the classical hyperparameter space alone is useful, but still limited.
TABLE III: QAOA: crash statistics over T = 20 trials with budget B = 2,000 hybrid runs per trial. Values are reported as mean ± standard deviation.
Crash count distribution (VQE, budget=2000, N=20 trials) 1600
Number of crashes per trial
1400 1200 1000 800 600 400
Strategy
Crashes per trial
Crash rate
RH ENUM ENUM-FUZZ RAND-FUZZ SYM-FUZZ
305.9 ± 13.5 301.8 ± 13.1 721.4 ± 329.5 861.7 ± 119.5 773.6 ± 427.6
0.153 ± 0.007 0.151 ± 0.007 0.361 ± 0.165 0.431 ± 0.060 0.387 ± 0.214
200 ENUM
CF-ENUM
RANDOM-FUZZ
CF-SYM
1600
Fig. 4: VQE: distribution of crash counts per trial for each strategy over T = 20 trials with budget B = 2,000. Boxes show interquartile ranges; whiskers and markers indicate spread and outliers. q0
H
q1
H
q2
H
q3
H
q0
RZ
2.0* _0
RZ
RX
2.0* _0
RZ
RX
2.0* _0
2.0* _1
RZ
RX
2.0* _1
2.0* _0
RZ
2.0* _0
2.0* _1
RX
2.0* _1
2.0* _0
RZ
RZ
RX
2.0* _0
RX
2.0* _0
2.0* _1
RZ
2.0* _1
RX
1200 1000 800 600 400 200 0 RH
ENUM
CF-ENUM
RANDOM-FUZZ
CF-SYM
2.0* _1
q1 q2 q3
Crash count distribution (QAOA, budget=2000, N=20 trials)
1400 Number of crashes per trial
RH
RX
2.0* _1
Fig. 5: QAOA ansatz used in the case study: depth-P QAOA ⊗n for MaxCut on a 4-node ring graph, starting from |+⟩ and alternating cost layers with ZZ(γℓ ) rotations on each edge and mixer layers with RX(2βℓ ) rotations on all qubits. The largest gains come from strategies that reuse crash information through local fuzzing. The three failure-guided fuzzing strategies, i.e., ENUM-FUZZ, RAND-FUZZ, and SYM-FUZZ find 1387.3 ± 223.7, 1430.5 ± 86.9, and 1513.8 ± 66.3 crashes per trial, respectively. Thus, local fuzzing around failure-prone seeds is the dominant source of improvement over RH and ENUM. Among the local-fuzzing strategies, SYM-FUZZ performs best, achieving the highest mean crash count and the lowest variance among the three high-performing methods. This suggests that, for the VQE workload, lightweight concolic seed discovery can improve the quality of seeds supplied to the local fuzzing phase. Overall, the VQE results support a layered interpretation: classical enumeration improves over random testing, local fuzzing around crash seeds yields a much larger gain, and concolic seed discovery appears to provide an additional benefit when used to select seeds for local fuzzing. The exported crash seeds further suggest that severe VQE failures often combine unfavorable optimizer settings with circuit-parameter vectors that fail to reach the target energy within the allotted optimization budget. B. QAOA Case Study The second case study is a QAOA instance for MaxCut on a 4-node ring graph. Figure 5 shows the P -layer QAOA ⊗n ansatz: the circuit prepares |+⟩ and then alternates cost
Fig. 6: QAOA: distribution of crash counts per trial for each strategy over T = 20 trials with budget B = 2,000.
layers, implemented by two-qubit ZZ(γℓ ) rotations along the graph edges, with mixer layers, implemented by single-qubit RX(2βℓ ) rotations on all qubits. Crash counts and crash rates. Table III and Fig. 6 show that QAOA has a higher RH baseline crash rate than VQE. RH finds 305.9 ± 13.5 crashes per trial, corresponding to a crash rate of 0.153 ± 0.007. ENUM performs almost identically to RH, with 301.8 ± 13.1 crashes per trial and a crash rate of 0.151 ± 0.007. This suggests that classical enumeration alone does not provide a meaningful advantage for this workload. As in VQE, the largest gains come from strategies that reuse crash information through local fuzzing. RAND-FUZZ achieves the highest mean crash count on QAOA, with 861.7±119.5 crashes per trial and a crash rate of 0.431±0.060. ENUM-FUZZ and SYM-FUZZ also outperform RH and ENUM, reaching 721.4 ± 329.5 and 773.6 ± 427.6 crashes per trial, respectively. However, unlike in the VQE case, neither concolic-guided strategy clearly exceeds RAND-FUZZ on average, and SYM-FUZZ exhibits particularly high variance. These results indicate that local fuzzing remains highly effective on QAOA, but the added value of concolic seed discovery is weaker and less stable than in VQE. A plausible explanation is that the QAOA failure landscape is more rugged or fragmented: random seed discovery can already find failureprone regions, while symbolic exploration over the small discrete classical space does not consistently identify better seeds. Representative problematic QAOA seeds often combine small iteration budgets or aggressive learning rates with circuit parameter vectors that remain far from the target cut value after optimization.
TABLE IV: Selected Mann–Whitney U test [18] is employed for pairwise comparisons of per-trial crash counts, and Cliff’s δ [19] is used to report effect size. p-value
Cliff’s δ
RH vs. ENUM RH vs. RAND-FUZZ RH vs. ENUM-FUZZ RH vs. SYM-FUZZ SYM-FUZZ vs. RAND-FUZZ
5.99 × 10−8 6.22 × 10−8 6.23 × 10−8 6.23 × 10−8 6.82 × 10−3
1.00 −1.00 −1.00 −1.00 0.50
RH vs. ENUM RH vs. RAND-FUZZ RH vs. ENUM-FUZZ RH vs. SYM-FUZZ SYM-FUZZ vs. RAND-FUZZ
4.65 × 10−1 6.27 × 10−8 3.28 × 10−5 1.52 × 10−4 7.05 × 10−1
0.14 −1.00 −0.77 −0.70 −0.07
Workload
Comparison
VQE VQE VQE VQE VQE QAOA QAOA QAOA QAOA QAOA
C. Statistical and Robustness Checks Table IV supports the main trends. On VQE, ENUMFUZZ, RAND-FUZZ, and SYM-FUZZ all significantly outperform RH, and SYM-FUZZ also outperforms RAND-FUZZ, indicating that concolic seed discovery adds benefit beyond unguided local fuzzing on this workload. On QAOA, all three local-fuzzing strategies significantly outperform RH, whereas ENUM does not; SYM-FUZZ is also not significantly different from RAND-FUZZ. These results support the conclusion that local fuzzing is robustly useful, while the added value of concolic guidance is workload-dependent. A sensitivity check varied the non-convergence tolerance and local fuzzing scale σ. The main trends remain stable across all tested settings: all local-fuzzing strategies continued to outperform RH and ENUM. On VQE, SYM-FUZZ is strongest in most settings and achieves the highest peak mean crash count, ranging from 945.5 to 1832.7 mean crashes, while RAND-FUZZ led in some looser threshold or largerσ settings. On QAOA, RAND-FUZZ is strongest or nearstrongest across settings, with mean crash counts ranging from 658.2 to 1159.1. Detailed per-trial results, exported seeds, clustering summaries, and scripts are included in the artifact. D. Answers to RQs RQ1. Across both workloads, strategies that reuse crash information through local fuzzing substantially outperform RH and ENUM under the same budget. This shows that the main gain comes from local circuit-parameter fuzzing around failure-prone seeds, rather than from classical exploration. RQ2. The benefit of concolic seed discovery is workloaddependent. On VQE, SYM-FUZZ performs best, suggesting that symbolic exploration can identify higher-quality seeds for local fuzzing. On QAOA, RAND-FUZZ matches or exceeds ENUM-FUZZ and SYM-FUZZ on average, indicating that random seed discovery plus local fuzzing can be competitive on more fragmented failure landscapes. RQ3. The strategies are more stable on VQE than on QAOA. SYM-FUZZ achieves the highest mean crash count with relatively low variance on VQE, whereas the QAOA results show larger run-to-run variability, especially for ENUMFUZZ and SYM-FUZZ. Overall, failure-guided local fuzzing
is robustly useful, but the added value of concolic guidance depends on the workload. VI. T HREATS TO VALIDITY Internal validity. The hybrid drivers, seed-discovery procedures, and fuzzing logic are implemented in-house, so implementation bugs could bias the results. This risk is mitigated by validating the non-convergence oracles on hand-checked configurations, cross-checking results with simpler baselines, and inspecting crash distributions and exported seed sets. Construct validity. Crash count and crash rate are budgetaware proxies for reaching non-convergent regions, but they do not necessarily correspond to distinct root-cause faults. Nearby crashes may reflect multiple manifestations of the same issue. The artifact includes an approximate clustering check of exported crash seeds, but clustering does not replace root-cause analysis or injected-fault benchmarks for measuring distinct failures. In addition, the use of “concolic” is intentionally modest: SYM-FUZZ reasons only over a small, discrete classical hyperparameter space and does not encode real-valued circuit parameters or quantum semantics. External validity and scalability. The evaluation uses two small workloads on a noiseless simulator, so the results may not generalize to larger HQC programs, calibrated noisy simulators, or hardware backends. Failure-guided fuzzing also does not reduce the underlying cost of running the hybrid program, which grows with qubit count, circuit depth, and shots; it reallocates a fixed budget toward configurations that appear failure-prone. Scaling to larger ansätze and richer hyperparameter spaces will require stronger seed-selection policies, bounding heuristics, and more expressive symbolic constraints. VII. C ONCLUSIONS AND F UTURE W ORK This paper studied failure-guided fuzzing for HQC programs on two NISQ workloads: a 2-qubit VQE instance and a 4-qubit QAOA MaxCut instance. The study modeled hybrid inputs as classical optimizer configurations coupled with quantum circuit parameters, defined a non-convergence oracle, and compared five budgeted strategies: RH, ENUM, RAND-FUZZ, ENUM-FUZZ, and SYM-FUZZ. The results show that reusing crash information through local fuzzing is the primary source of improvement over RH and ENUM, while concolic seed discovery in SYM-FUZZ provides additional benefits on VQE but is less stable on QAOA. These findings position failure-guided fuzzing as a complementary direction to existing quantum fuzzing and concolic-testing work by operating at the hybrid-driver level and treating (c, θ) jointly. Future work should extend the prototype with richer symbolic reasoning, broader HQC benchmarks, calibrated noisy backends, and more diverse oracles and coverage metrics. A larger-scale analysis of failure diversity and root causes are also needed to move from raw crash counts toward more actionable testing feedback for reliable quantum software engineering.
DATA AVAILABILITY The artifact is available at doi:10.5281/zenodo.19718515. R EFERENCES [1] J. Tilly, H. Chen, S. Cao, D. Picozzi, K. Setia, Y. Li, E. Grant, L. Wossnig, I. Rungger, G. H. Booth et al., “The variational quantum eigensolver: a review of methods and best practices,” Physics Reports, vol. 986, pp. 1–128, 2022. [2] R. Fakhimi and H. Validi, “Quantum approximate optimization algorithm (qaoa),” in Encyclopedia of Optimization. Springer, 2023, pp. 1–7. [3] K. Bharti, A. Cervera-Lierta, T. H. Kyaw, T. Haug, S. Alperin-Lea, A. Anand, M. Degroote, H. Heimonen, J. S. Kottmann, T. Menke et al., “Noisy intermediate-scale quantum algorithms,” Reviews of Modern Physics, vol. 94, no. 1, p. 015004, 2022. [4] L. Zhang, M. Radnejad, and A. Miranskyy, “Identifying flakiness in quantum programs,” in 2023 ACM/IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM). IEEE, 2023, pp. 1–7. [5] D. Kim, H. Khoramrokh, L. Zhang, and A. Miranskyy, “Detecting flaky tests in quantum software: A dynamic approach,” arXiv preprint arXiv:2512.18088, 2025. [6] A. Miranskyy, J. Campos, A. Mjeda, L. Zhang, and I. G. R. de Guzmán, “On the feasibility of quantum unit testing,” arXiv preprint arXiv:2507.17235, 2025. [7] A. Miranskyy and L. Zhang, “On testing quantum programs,” in 2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER). IEEE, 2019, pp. 57–60. [8] D. Fortunato, J. Campos, and R. Abreu, “Qmutpy: A mutation testing tool for quantum algorithms and applications in qiskit,” in Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, 2022, pp. 797–800. [9] E. Mendiluze, S. Ali, P. Arcaini, and T. Yue, “Muskit: A mutation analysis tool for quantum software testing,” in 2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 2021, pp. 1266–1270. [10] J. Wang, M. Gao, Y. Jiang, J. Lou, Y. Gao, D. Zhang, and J. Sun, “Quanfuzz: Fuzz testing of quantum program,” arXiv preprint arXiv:1810.10310, 2018. [11] J. Zhao, “Quantum software engineering: Landscapes and horizons,” arXiv preprint arXiv:2007.07047, 2020. [12] L. De Moura and N. Bjørner, “Z3: An efficient smt solver,” in International conference on Tools and Algorithms for the Construction and Analysis of Systems. Springer, 2008, pp. 337–340. [13] K. Sen, “Concolic testing,” in Proceedings of the 22nd IEEE/ACM international conference on Automated software engineering, 2007, pp. 571–572. [14] P. Godefroid, M. Y. Levin, D. A. Molnar et al., “Automated whitebox fuzz testing.” in Ndss, vol. 8, 2008, pp. 151–166. [15] A. Javadi-Abhari, M. Treinish, K. Krsulich, C. J. Wood, J. Lishman, J. Gacon, S. Martiel, P. D. Nation, L. S. Bishop, A. W. Cross et al., “Quantum computing with qiskit,” arXiv preprint arXiv:2405.08810, 2024. [16] T. Hao, K. Liu, and S. Tannu, “Enabling high performance debugging for variational quantum algorithms using compressed sensing,” in Proceedings of the 50th Annual International Symposium on Computer Architecture, 2023, pp. 1–13. [17] S. Chundury, Z. Xu, A. Shehata, S. Kim, F. Mueller, and I.-S. Suh, “Quantum simulators and applications on quantum framework,” in 2025 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 2. IEEE, 2025, pp. 522–523. [18] H. B. Mann and D. R. Whitney, “On a test of whether one of two random variables is stochastically larger than the other,” The annals of mathematical statistics, pp. 50–60, 1947. [19] N. Cliff, “Dominance statistics: Ordinal analyses to answer ordinal questions.” Psychological bulletin, vol. 114, no. 3, p. 494, 1993.